Description
This article describes that, by default, the source MAC addresses of 'devices' do not appear in logs, and the Source MAC column will be empty.
Scope
FortiAnalyzer.
Solution
To see this information, enable 'Device detection' under Network -> Interfaces, edit the interface, then under Network enable 'Device detection'.
The Source MAC address column can now be populated.
Note:
The device must be connected directly. If there is a switch in between, the user may see the MAC address entry of the switch in the logs.
Related article:
